<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.ssdt : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="module">v.p.ssdt : module documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a></span>
      
      
    </p>
    <div>
      
    </div>
    <div>&#64;author:       AAron Walters and Brendan Dolan-Gavitt
&#64;license:      GNU General Public License 2.0 or later
&#64;contact:      <a class="rst-reference external" href="mailto:awalters&#64;volatilesystems.com" target="_top">awalters&#64;volatilesystems.com</a>,bdolangavitt&#64;wesleyan.edu
&#64;organization: Volatile Systems<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id1156">
  
  
<tr class="function">
    
    
    <td>Function</td>
    <td><a href="volatility.plugins.ssdt.html#find_tables">find_tables</a></td>
    <td><span>This function finds the RVAs to KeServiceDescriptorTable and KeServiceDescriptorTableShadow in the NT module.</span></td>
  </tr><tr class="class">
    
    
    <td>Class</td>
    <td><a href="volatility.plugins.ssdt.SSDT.html">SSDT</a></td>
    <td><span>Display SSDT entries</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.ssdt.find_tables">
    
  </a>
  <a name="find_tables">
    
  </a>
  <div class="functionHeader">
    
    def
    find_tables(start_addr, vm):
    
  </div>
  <div class="functionBody">
    
    <div>This function finds the RVAs to KeServiceDescriptorTable
and KeServiceDescriptorTableShadow in the NT module.</p>
<p>&#64;param start_addr: virtual address of KeAddSystemServiceTable
&#64;param vm: kernel address space</p>
<p>We're looking for two instructions like this:</p>
<p>//if (KeServiceDescriptorTable[i].Base)
4B 83 BC 1A 40 88 2A 00 00    cmp qword ptr [r10+r11+2A8840h], 0
//if (KeServiceDescriptorTableShadow[i].Base)
4B 83 BC 1A 80 88 2A 00 00    cmp qword ptr [r10+r11+2A8880h], 0</p>
<p>In the example, 2A8840h is the RVA of KeServiceDescriptorTable
and 2A8880h is the RVA of KeServiceDescriptorTableShadow. The
exported KeAddSystemServiceTable is a very small function (about
120 bytes at the most) and the two instructions appear very
early, which reduces the possibility of false positives.</p>
<p>If distorm3 is installed, we use it to decompose instructions
in x64 format. If distorm3 is not available, we use Volatility's
object model as a very simple and generic instruction parser.<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>